THENG
/
ZLMediaKit
mirror of https://gitcode.com/gh_mirrors/zlme/ZLMediaKit.git
6
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

修正了Sctp访问越界和多线程访问静态buffer的问题

This commit is contained in:
Sandro 2024-01-05 15:22:29 +08:00
parent c0062f40d1
commit e8e6edf93b
1 changed files with 13 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
webrtc/SctpAssociation.cpp
View File

@ -674,15 +674,14 @@ namespace RTC
case SCTP_COMM_LOST: case SCTP_COMM_LOST:
{ {
auto offset = (char *)&notification->sn_assoc_change.sac_info[0] - (char *)notification; if (notification->sn_header.sn_length > 0)
auto len = (ptrdiff_t)notification->sn_assoc_change.sac_length - offset;
if (len > 0)
{ {
static const size_t BufferSize{ 1024 }; static const size_t BufferSize{ 1024 };
static char buffer[BufferSize]; thread_local static char buffer[BufferSize];
for (uint32_t i{ 0 }; i < (uint32_t)len; ++i) uint32_t len = notification->sn_assoc_change.sac_length - sizeof(struct sctp_assoc_change);
for (uint32_t i{ 0 }; i < len; ++i)
{ {
std::snprintf( std::snprintf(
buffer, BufferSize, " 0x%02x", notification->sn_assoc_change.sac_info[i]); buffer, BufferSize, " 0x%02x", notification->sn_assoc_change.sac_info[i]);
@ -743,15 +742,14 @@ namespace RTC
case SCTP_CANT_STR_ASSOC: case SCTP_CANT_STR_ASSOC:
{ {
auto offset = (char *)&notification->sn_assoc_change.sac_info[0] - (char *)notification; if (notification->sn_header.sn_length > 0)
auto len = (ptrdiff_t)notification->sn_assoc_change.sac_length - offset;
if (len > 0)
{ {
static const size_t BufferSize{ 1024 }; static const size_t BufferSize{ 1024 };
static char buffer[BufferSize]; thread_local static char buffer[BufferSize];
for (uint32_t i{ 0 }; i < (uint32_t)len; ++i) uint32_t len = notification->sn_assoc_change.sac_length - sizeof(struct sctp_assoc_change);
for (uint32_t i{ 0 }; i < len; ++i)
{ {
std::snprintf( std::snprintf(
buffer, BufferSize, " 0x%02x", notification->sn_assoc_change.sac_info[i]); buffer, BufferSize, " 0x%02x", notification->sn_assoc_change.sac_info[i]);
@ -788,7 +786,7 @@ namespace RTC
case SCTP_REMOTE_ERROR: case SCTP_REMOTE_ERROR:
{ {
static const size_t BufferSize{ 1024 }; static const size_t BufferSize{ 1024 };
static char buffer[BufferSize]; thread_local static char buffer[BufferSize];
uint32_t len = notification->sn_remote_error.sre_length - sizeof(struct sctp_remote_error); uint32_t len = notification->sn_remote_error.sre_length - sizeof(struct sctp_remote_error);
@ -824,7 +822,7 @@ namespace RTC
case SCTP_SEND_FAILED_EVENT: case SCTP_SEND_FAILED_EVENT:
{ {
static const size_t BufferSize{ 1024 }; static const size_t BufferSize{ 1024 };
static char buffer[BufferSize]; thread_local static char buffer[BufferSize];
uint32_t len = uint32_t len =
notification->sn_send_failed_event.ssfe_length - sizeof(struct sctp_send_failed_event); notification->sn_send_failed_event.ssfe_length - sizeof(struct sctp_send_failed_event);